wiki created

Payload_Type/cazalla/cazalla/agent_functions/cat.py

@@ -28,8 +28,8 @@ class CatArguments(TaskArguments):
 class CatCommand(CommandBase):
     cmd = "cat"
     needs_admin = False
-    help_cmd = "cat C:\\ruta\\al\\archivo.txt"
-    description = "Lee el contenido de un archivo y detecta credenciales automáticamente"
+    help_cmd = "cat <file_path>"
+    description = "Read and display the contents of a file on the target system. Supports both absolute and relative paths (relative paths are resolved using the current working directory). Automatically detects and extracts credentials from file contents including: plaintext passwords, NTLM hashes (aad3b435b51404ee:hash format), and domain credentials. Detected credentials are automatically added to Mythic's credential store. Useful for reading configuration files, log files, and credential databases."
     version = 1
     author = "Kaseya OFSTeam"
     attackmapping = []

Payload_Type/cazalla/cazalla/agent_functions/cd.py

@@ -27,8 +27,8 @@ class CdArguments(TaskArguments):
 class CdCommand(CommandBase):
     cmd = "cd"
     needs_admin = False
-    help_cmd = "cd C:\\directorio\\al\\que\\cambiar"
-    description = "Cambiar directorio de trabajo."
+    help_cmd = "cd <path>"
+    description = "Change the current working directory for the agent. The new directory path is automatically tracked and displayed in the Mythic UI context tabs. Supports both absolute paths (e.g., 'C:\\Windows\\System32') and relative paths. The current directory is used by other file system commands (cat, download, upload, etc.) when relative paths are provided."
     version = 1
     author = "Kaseya OFSTeam"
     attackmapping = []

Payload_Type/cazalla/cazalla/agent_functions/cp.py

@@ -36,8 +36,8 @@ class CpArguments(TaskArguments):
 class CpCommand(CommandBase):
     cmd = "cp"
     needs_admin = False
-    help_cmd = "cp c:\\ruta\\fichero c:\\ruta\\a\\copiar"      
-    description = "Copia un fichero a un nuevo destino."
+    help_cmd = "cp <source_path> <destination_path>"
+    description = "Copy a file from a source location to a destination path on the target system. Supports both absolute and relative paths (relative paths are resolved using the current working directory). The destination file will be overwritten if it already exists. Creates a 'File Write' artifact for the destination file. Useful for creating backups, moving files, or preparing payloads in staging directories."
     version = 1
     author = "Kaseya OFSTeam"
     attackmapping = []

Payload_Type/cazalla/cazalla/agent_functions/download.py

@@ -29,8 +29,8 @@ class DownloadArguments(TaskArguments):
 class DownloadCommand(CommandBase):
     cmd = "download"
     needs_admin = False
-    help_cmd = "download <path>"
-    description = "Download a file from the target to the Mythic server"
+    help_cmd = "download <file_path>"
+    description = "Download a file from the target system to the Mythic server. Supports files up to 2GB in size. Files are transferred in 512KB chunks for efficient transmission. Supports both absolute and relative paths (relative paths are resolved using the current working directory). Compatible with Mythic File Browser for interactive file selection. Large files or sensitive files may trigger detection by EDR/XDR solutions and data loss prevention (DLP) systems."
     version = 1
     supported_ui_features = ["file_browser:download"]
     author = "@KaseyaOFSTeam"

Payload_Type/cazalla/cazalla/agent_functions/exit.py

@@ -18,7 +18,7 @@ class ExitCommand(CommandBase):
     cmd = "exit"
     needs_admin = False
     help_cmd = "exit"
-    description = "Task the implant to exit."
+    description = "Instruct the agent to exit and terminate. The agent will perform cleanup operations and then terminate its process. This command is permanent - the agent will stop running and will not check in again. Use this command when you want to remove the agent from the target system or when operational requirements dictate agent termination. Compatible with Mythic's callback table exit functionality."
     version = 1
     is_exit = True  # Important: marks this as an exit command (like Athena)
     supported_ui_features = ["callback_table:exit"]

Payload_Type/cazalla/cazalla/agent_functions/keylog_start.py

@@ -15,7 +15,7 @@ class KeylogStartCommand(CommandBase):
     cmd = "keylog_start"
     needs_admin = False
     help_cmd = "keylog_start"
-    description = "Start a low-level keyboard logger and stream keylogs to Mythic"
+    description = "Start a low-level keyboard logger that captures all keystrokes from the system and streams them to Mythic in real-time. Uses Windows keyboard hooking mechanisms (SetWindowsHookEx) to intercept keyboard input at a low level. CRITICAL OPSEC RISK: Keyloggers are extremely detectable by EDR/XDR solutions, anti-malware, and behavioral analysis engines. Detection is likely within minutes or hours. Always requires approval from a lead operator. Consider alternatives such as credential theft, browser credential extraction, or clipboard monitoring for better OPSEC."
     version = 1
     author = "@KaseyaOFSTeam"
     argument_class = KeylogStartArguments

Payload_Type/cazalla/cazalla/agent_functions/keylog_stop.py

@@ -15,7 +15,7 @@ class KeylogStopCommand(CommandBase):
     cmd = "keylog_stop"
     needs_admin = False
     help_cmd = "keylog_stop"
-    description = "Stop the active keylogger"
+    description = "Stop the active keyboard logger and remove the keyboard hooks. This command safely terminates keylogging operations and cleans up the hooking mechanisms. Use this command when keylogging is no longer needed to reduce detection risk and free system resources."
     version = 1
     author = "@KaseyaOFSTeam"
     argument_class = KeylogStopArguments

Payload_Type/cazalla/cazalla/agent_functions/kill.py

@@ -67,7 +67,7 @@ class KillCommand(CommandBase):
     cmd = "kill"
     needs_admin = False
     help_cmd = "kill <pid>"
-    description = "Terminate a process by PID"
+    description = "Terminate a process by its Process ID (PID). The process is immediately terminated using TerminateProcess API. Compatible with Mythic Process Browser for interactive process termination. Automatically removes the killed process from the Process Browser view. WARNING: Critical system processes (PID 0, 4, 8) are blocked from termination to prevent system instability. Creates a 'Process Termination' artifact for tracking."
     version = 1
     author = "@KaseyaOFSTeam"
     attackmapping = ["T1489"]

Payload_Type/cazalla/cazalla/agent_functions/list_tokens.py

@@ -47,7 +47,7 @@ class ListTokensCommand(CommandBase):
     cmd = "list_tokens"
     needs_admin = False
     help_cmd = "list_tokens"
-    description = "List all available tokens from running processes"
+    description = "Enumerate and list all available security tokens from running processes on the target system. Shows detailed token information including user context, privileges, and groups for each process. Compatible with Mythic Process Browser for interactive token enumeration. Useful for reconnaissance to identify high-value tokens before attempting token theft. Lower detection risk than token theft operations, but token enumeration may still be logged by security tools."
     version = 1
     author = "@KaseyaOFSTeam"
     supported_ui_features = ["process_browser:list_tokens"]

Payload_Type/cazalla/cazalla/agent_functions/ls.py

@@ -98,8 +98,8 @@ class LsArguments(TaskArguments):
 class LsCommand(CommandBase):
     cmd = "ls"
     needs_admin = False
-    help_cmd = "ls [directorio]"
-    description = "listado de informacion del <directorio>"
+    help_cmd = "ls [path]"
+    description = "List directory contents with detailed file information including type (File/Directory), size, modification date, and name. Supports wildcards (e.g., 'ls C:\\Windows\\*.exe'). If no path is specified, lists the current working directory. Compatible with Mythic File Browser for interactive file management."
     version = 1
     supported_ui_features = ["file_browser:list"]
     author = "Kaseya OFSTeam"

Payload_Type/cazalla/cazalla/agent_functions/make_token.py

@@ -70,7 +70,7 @@ class MakeTokenCommand(CommandBase):
     cmd = "make_token"
     needs_admin = False
     help_cmd = "make_token <domain> <username> <password> [logon_type]"
-    description = "Create a token and impersonate it using plaintext credentials"
+    description = "Create a new security token using plaintext credentials and impersonate it. Authenticates with the provided domain (or local machine if empty), username, and password using LogonUser API. The logon_type parameter (default: 9 - NewCredentials) determines the authentication type. The impersonation context is automatically tracked and displayed in the Mythic UI. Less detectable than 'steal_token' as it doesn't require accessing LSASS memory, but may still generate authentication logs. Use 'rev2self' to revert to the original token."
     version = 1
     author = "@KaseyaOFSTeam"
     attackmapping = ["T1134.003"]

Payload_Type/cazalla/cazalla/agent_functions/mkdir.py

@@ -27,8 +27,8 @@ class MkdirArguments(TaskArguments):
 class MkdirCommand(CommandBase):
     cmd = "mkdir"
     needs_admin = False
-    help_cmd = "mkdir C:\\nuevo\\directorio"
-    description = "Crea un nuevo directorio."
+    help_cmd = "mkdir <path>"
+    description = "Create a new directory on the target system. Supports both absolute and relative paths (relative paths are resolved using the current working directory). Creates parent directories if they don't exist. Useful for creating staging directories, temporary folders, or organizing files during post-exploitation activities."
     version = 1
     author = "Kaseya OFSTeam"
     attackmapping = []

Payload_Type/cazalla/cazalla/agent_functions/ps.py

@@ -18,7 +18,7 @@ class PsCommand(CommandBase):
     cmd = "ps"
     needs_admin = False
     help_cmd = "ps"
-    description = "Lista los procesos del host."
+    description = "List all running processes on the target system. Displays detailed process information including PID, process name, parent PID, architecture (x64/x86), username, and session ID. Automatically updates the Mythic Process Browser, allowing interactive process management (kill, steal_token, list_tokens) directly from the UI. The Process Browser cache is automatically cleared to show only currently running processes."
     version = 1
     supported_ui_features = ["process_browser:list"]
     author = "Kaseya OFSTeam"

Payload_Type/cazalla/cazalla/agent_functions/pwd.py

@@ -16,7 +16,7 @@ class PwdCommand(CommandBase):
     cmd = "pwd"
     needs_admin = False
     help_cmd = "pwd"
-    description = "Muestra el directorio actual"
+    description = "Display the current working directory of the agent. Shows the absolute path that the agent is currently using as its working directory. This directory is automatically tracked and displayed in the Mythic UI context tabs. Useful for verifying the current location before executing file system operations."
     version = 1
     author = "Kaseya OFSTeam"
     attackmapping = []

Payload_Type/cazalla/cazalla/agent_functions/rev2self.py

@@ -18,7 +18,7 @@ class Rev2SelfCommand(CommandBase):
     cmd = "rev2self"
     needs_admin = False
     help_cmd = "rev2self"
-    description = "Revert token impersonation back to original token"
+    description = "Revert token impersonation back to the original process token. This command stops impersonating any stolen or created token and returns to the agent's original security context. The impersonation context in the Mythic UI is automatically cleared. Use this command after completing operations that required elevated privileges to return to a less-privileged context and reduce detection risk."
     version = 1
     author = "@KaseyaOFSTeam"
     attackmapping = ["T1134.001"]

Payload_Type/cazalla/cazalla/agent_functions/rm.py

@@ -66,8 +66,8 @@ class RmArguments(TaskArguments):
 class RmCommand(CommandBase):
     cmd = "rm"
     needs_admin = False
-    help_cmd = "rm C:\\ruta\\al\\DirectorioOFichero"
-    description = "Elimina un fichero o un directorio"
+    help_cmd = "rm <path>"
+    description = "Delete a file or directory from the target system. Supports both absolute and relative paths (relative paths are resolved using the current working directory). Can delete individual files or entire directories. WARNING: Deletion of critical system files or directories (System32, Windows, Program Files, etc.) will be blocked for safety. Use with caution as deleted files cannot be recovered through this command."
     version = 1
     supported_ui_features = ["file_browser:remove"]
     author = "Kaseya OFSTeam"

Payload_Type/cazalla/cazalla/agent_functions/rpfwd.py

@@ -81,7 +81,7 @@ class RpfwdCommand(CommandBase):
     cmd = "rpfwd"
     needs_admin = False
     help_cmd = "rpfwd start [local_port] [remote_host] [remote_port] / rpfwd stop"
-    description = "Inicia o detiene el reverse port forwarding. El agente escucha en local_port y Mythic reenvía a remote_host:remote_port. Puerto local por defecto: 8080"
+    description = "Start or stop reverse port forwarding (RPFWD). When started, the agent listens on a local port on the target system. Connections to this local port are forwarded through the agent to Mythic, which then connects to a remote destination (remote_host:remote_port). Default local port: 8080. Useful for accessing services on the target network that are not directly reachable from Mythic (e.g., internal services, databases, management interfaces). WARNING: Reverse port forwarding creates persistent network connections and may be detected by network monitoring, firewall logging, NIDS, and EDR/XDR network monitoring. Avoid using privileged ports (<1024) which require elevated privileges."
     version = 1
     author = "OFSTeam"
     argument_class = RpfwdArguments

Payload_Type/cazalla/cazalla/agent_functions/screenshot.py

@@ -20,7 +20,7 @@ class ScreenshotCommand(CommandBase):
     cmd = "screenshot"
     needs_admin = False
     help_cmd = "screenshot"
-    description = "Capture a screenshot of the desktop and upload it to Mythic"
+    description = "Capture a screenshot of the primary desktop display and upload it to the Mythic server. Uses Windows GDI API (BitBlt) to capture the screen content. The screenshot is automatically uploaded as a file to Mythic for viewing. Requires an active interactive desktop session. May be detected by screen capture detection mechanisms, behavioral analysis, and data loss prevention (DLP) systems. Large screenshots may trigger network monitoring alerts."
     version = 1
     author = "@KaseyaOFSTeam"
     argument_class = ScreenshotArguments

Payload_Type/cazalla/cazalla/agent_functions/shell.py

@@ -29,8 +29,8 @@ class ShellArguments(TaskArguments):
 class ShellCommand(CommandBase):
     cmd = "shell"
     needs_admin = False
-    help_cmd = "shell {command}"
-    description = "Ejecuta comandos de shell en el sistema NOTA: ESTO ES CERO OPSEC"
+    help_cmd = "shell <command>"
+    description = "Execute arbitrary shell commands on the target system by spawning cmd.exe. The command is executed in a non-interactive shell and the output is captured and returned. HIGH OPSEC RISK: This command spawns cmd.exe which is heavily monitored by EDR/XDR solutions. Command execution and command-line arguments are logged by security tools. Consider using built-in Cazalla commands (ps, ls, cat, etc.) instead when possible, as they provide better OPSEC. Always requires approval from another operator before execution."
     version = 1
     author = "Kaseya OFSTeam"
     attackmapping = ["T1059"]

Payload_Type/cazalla/cazalla/agent_functions/sleep.py

@@ -55,8 +55,8 @@ class SleepArguments(TaskArguments):
 class SleepCommand(CommandBase):
     cmd = "sleep"
     needs_admin = False
-    help_cmd = "sleep <segundos> [jitter]"
-    description = "Cambiar el sleep."
+    help_cmd = "sleep <seconds> [jitter]"
+    description = "Change the agent's sleep interval (check-in frequency) and optional jitter percentage. The sleep interval determines how long the agent waits between check-ins with the Mythic server. Jitter adds random variation to the sleep interval to avoid predictable timing patterns. Lower sleep values provide more responsive interaction but increase network activity and detection risk. Higher sleep values reduce detection risk but make the agent less responsive. Jitter helps evade behavioral detection based on timing analysis."
     version = 1
     author = "Kaseya OFSTeam"
     attackmapping = ["T1029"]

Payload_Type/cazalla/cazalla/agent_functions/socks.py

@@ -59,7 +59,7 @@ class SocksCommand(CommandBase):
     cmd = "socks"
     needs_admin = False
     help_cmd = "socks start [port] / socks stop [port]"
-    description = "Inicia o detiene el proxy SOCKS en el servidor Mythic. Puerto por defecto: 7002"
+    description = "Start or stop a SOCKS5 proxy server on the Mythic server. When started, the SOCKS proxy allows routing network traffic through the agent to access internal network resources. The default port is 7002. The proxy runs on the Mythic server and uses the agent as a tunnel for network connections. WARNING: SOCKS proxies generate continuous network traffic and may be detected by network monitoring tools, firewall logging, EDR/XDR network monitoring, and network flow analysis. Use non-standard ports and be aware of high bandwidth usage."
     version = 1
     author = "OFSTeam"
     argument_class = SocksArguments

Payload_Type/cazalla/cazalla/agent_functions/steal_token.py

@@ -67,7 +67,7 @@ class StealTokenCommand(CommandBase):
     cmd = "steal_token"
     needs_admin = False
     help_cmd = "steal_token <pid>"
-    description = "Steal and impersonate the token of a target process"
+    description = "Steal and impersonate the security token from a target process. Opens the target process, extracts its token, and impersonates it to assume the security context (user, privileges, groups) of that process. Compatible with Mythic Process Browser for interactive token theft. The impersonation context is automatically tracked and displayed in the Mythic UI. CRITICAL OPSEC RISK: Token theft is heavily monitored by EDR/XDR solutions, especially when targeting LSASS or other critical processes. Always requires approval from another operator. Prefer 'make_token' for domain credentials when possible."
     version = 1
     author = "@KaseyaOFSTeam"
     attackmapping = ["T1134.001"]

Payload_Type/cazalla/cazalla/agent_functions/upload.py

@@ -60,8 +60,8 @@ class UploadArguments(TaskArguments):
 class UploadCommand(CommandBase):
     cmd = "upload"
     needs_admin = False
-    help_cmd = "upload <file> <path>"
-    description = "Upload a file from the Mythic server to the target"
+    help_cmd = "upload <file_id> <destination_path>"
+    description = "Upload a file from the Mythic server to the target system. Requires a file_id (obtained from Mythic's file browser) and a destination path where the file will be written. Supports both absolute and relative paths (relative paths are resolved using the current working directory). Creates a 'File Write' artifact for tracking. Uploads to sensitive locations (System32, Windows, Program Files) or with suspicious extensions (.exe, .dll, .ps1, .bat, .vbs) may trigger detection by security tools."
     version = 1
     supported_ui_features = ["file_browser:upload"]
     author = "@KaseyaOFSTeam"

Payload_Type/cazalla/cazalla/agent_functions/whoami.py

@@ -18,7 +18,7 @@ class WhoamiCommand(CommandBase):
     cmd = "whoami"
     needs_admin = False
     help_cmd = "whoami"
-    description = "Get current user context (thread token if impersonated, otherwise process token). Useful to verify steal_token/make_token worked correctly."
+    description = "Display the current security context of the agent. Shows the username and domain of the active security token. If token impersonation is active (via 'steal_token' or 'make_token'), displays the impersonated user context. Otherwise, displays the process token context. Useful for verifying that token operations succeeded and for confirming the current privilege level before executing commands that require specific permissions."
     version = 1
     author = "@KaseyaOFSTeam"
     attackmapping = ["T1083"]